What personal data is collected and from whom it is obtained

Transcription

1 LexisNexis Risk Solutions - Insurance Services Processing Notice Version 1.0 Last Updated: 24 th May 2018 This Processing Notice contains the following sections: What this Processing Notice covers How we use personal data What personal data is collected and from whom it is obtained How personal data is shared and retained How you can request to access, correct, or delete your personal data or ask us not to process your personal data How to contact us

2 What this Processing Notice covers This Processing Notice applies to services LexisNexis Risk Solutions ("LNRS", "we" or "us") (part of the RELX Group of companies) provides to business customers (such as insurers, brokers, other insurance intermediaries and their comparison service providers) (our Customers ) to help in their validation of the identities of people applying for home, motor or commercial insurance, to assist in their assessment and pricing of insurance risk, and for the purposes of fraud prevention. These services are the following, to the extent they are subject to the European Union ( EU ) General Data Protection Regulation ( GDPR ): Category Motor Home & Motor & Commercial Product LexisNexis Policy Insights LexisNexis Attract for Motor No Claims Discount Module for LexisNexis Policy History Motor LexisNexis Risk Insights LexisNexis Indicium Description Policy Insights provides information about policyholders and named drivers' previous motor insurance policies, so they can obtain a quote for insurance. We ask our Customers to let drivers know before they share policy information with us for example, by telling you about this during your application or within their processing notice. Attract for Motor uses some of the data from our Policy Insights and Risk Insights datasets to create an insurance risk score. This score is one factor that our Customers may use to assist them to more accurately predict risk and to determine the price of insurance premiums. The No Claims Discount Module helps our Customers in their validation of a motorists' entitlement to a discount for not having previous claims, by comparing what the motorist states with the No Claims Discount history collated from other insurers. Risk Insights can assist our Customers in verifying the identities of home, motor and commercial insurance applicants (e.g. homeowners, policyholders, named drivers and directors) and helps to establish measures of risk through the presence or absence of certain public data, such as court judgments. This can help our Customers prevent fraud and more accurately predict risk and determine the price of insurance premiums. Indicium assists our Customers in developing a specific risk score, which is one of the factors they may use in predicting the likelihood of an

3 insurance applicant making a claim in the future. This assists our Customers to price premiums more accurately at point of quote. LexisNexis Quote Intelligence Quote Intelligence helps our Customers to prevent fraud and assists in their pricing of insurance policies. Quote Intelligence identifies certain potentially unexpected, unusual or inconsistent connections between quotes or individuals named on a quote, for example by identifying when and how frequently an individual requests an insurance quote as well as identifying changes in some of the information provided in the course of obtaining quotes. This Processing Notice addresses where LNRS acts as a controller of your personal data in order or provide the product/sector categories outlined above. It does not include services where LNRS acts solely as a processor of personal data on behalf of Customers or where the European Union (EU) General Data Protection Regulation (GDPR) does not apply to the processing activities undertaken. How to know which services our Customers use The company from whom you obtained a quote for insurance will be able to tell you which of our services (if any) they used in assessing your insurance application or renewal. Who controls your personal data The LexisNexis Risk Solutions group of companies controls the personal data we use in these services. For more information on which LexisNexis company is the data controller for each product, please see the 'How to contact us' section below. Our Customers who use our services are also data controllers. These may include insurers, brokers and other insurance intermediaries. These Customers may also operate through online insurance comparison services who also act as data controllers. Their processing notices will tell you more about how they use personal data.

4 How we use personal data Using personal data for our and our Customers legitimate interests We use personal data to help our Customers to price insurance policies, check the identities of people applying for policies and prevent fraud. We also use personal data to develop and improve our products and services. We do not decide the price of insurance policies: our Customers do this independently. The personal data we provide to them and which we describe below are just some of the factors that they may consider. Insurers have to decide how much they should charge for a policy. This price is different for different individuals. For example, motor insurance prices reflect matters such as previous driving history or where the motorist lives. Insurers have a business interest in obtaining information about motorists applying for policies and we have a business interest in providing this information. Where we use personal data for a business interest, data protection law says that we have to make sure this interest is legitimate and we must make sure we can justify any impact on individuals. To help us do this, we regularly test our statistical models to check for errors or inaccuracy; we only collect information which we can show is relevant to the risk assessment of insurance policies; and our contracts with our Customers limit their use of personal data to insurance pricing, underwriting and fraud prevention decisions. We have set out more information about the legitimate business interests in processing personal data below: Purpose How is personal data used and why? No Claims Discount Module for LexisNexis Policy Motor History Verifying data you provide, assessing insurance risk and preventing fraud When you request a quote for insurance - whether this be through a price comparison site, broker or insurer website or by enquiry made through a call centre or branch - that insurance provider will usually ask you to confirm your entitlement to a No Claims Discount. We use information from your motor insurance policy history that we collect from other insurers to confirm whether the No Claims Discount that you have confirmed to our Customer matches our records. While only the Customer can decide whether you are eligible for a discount on the basis of this data, we only permit our Customers to use the data we provide to validate your no claims discount entitlement.

5 LexisNexis Policy Insights We provide personal data that helps insurers to make more informed underwriting and pricing decisions about motor insurance policies, by providing information about the motorists previous motor insurance history. We use information contributed to us by other insurers and brokers such as where individuals live, vehicle information and previous insurance policies to analyse their motor insurance history and to provide facts that are useful to insurers for predicting future risk. Each insurer will have its own criteria to assess what insurance cover to offer and what premium to request and they use various factors to help them including the data we provide. While only the insurer can assess what policy to offer on the basis of this data, we only permit our Customers to use this data to help prevent fraud and decide whether to offer insurance and, if so, what level of cover to offer and at what premium. LexisNexis Risk Insights When you request a quote for insurance - whether this be through a price comparison site, broker or insurer website or by enquiry made through a call centre or branch - that insurance provider will usually ask you to provide information about your identity and to answer certain questions. Our products and services allow our Customers to check this information and to obtain further information about you from publicly available data such as the Open Electoral Register, CCJ and insolvency data, together with data which may be accessed under Open Government Licence in respect of the area in which you live for example crime and unemployment figures. We may also access information provided by you to our business partners where permitted. We describe the information we receive from business partners below. Risk Insights summarises this information in a way that it can easily be used by our Customers in their risk assessment of you and use this

6 data, in combination with other information provided in your quote request or at renewal, to determine whether to present an insurance quote, the premium quoted and the policy terms offered. For example, if the address or date of birth you provide does not match our records then some of our Customers my decline to provide a quote or may offer a higher premium. LexisNexis Attract for Motor We use the information from LexisNexis Policy Insights and LexisNexis Risk Insights to create an overall insurance risk score. Insurers may use this at quote or renewal as one of the factors to help inform their risk assessment and to help them to decide on how to price your policy. When you request a quote for a motor insurance product, we will generate your insurance risk score. This score is a value between 200 and 997, with the highest scores representing the lowest risk to the insurer. This will include information, such as how long you have continuously held an insurance policy, your presence on the Open Electoral Register and general indicators about the area in which you live including publicly available crime rate information which may work to increase your score, if, for example you have held insurance for a long time or live in a low crime neighbourhood. This will also include data that can lower your score, such as whether you have previously had a policy cancelled or cancelled a policy yourself, or whether you have had a county court judgment against you. While only the insurance provider can assess what policy to offer on the basis of this data, we only permit our Customers to use this data to help prevent fraud and decide whether to offer insurance and, if so, what level of cover to offer at what premium. LexisNexis Indicium We use information from our databases to create an overall risk score that helps insurers assess the price they offer for home, motor or commercial insurance. When you request an insurance quote - whether this be through a price comparison site, broker or insurer website or by enquiry made through a call centre or branch - we will generate an insurance risk score on behalf of an insurance provider. The score is a numeric value that is scaled according to the likely risk presented by an individual

7 with the highest scores representing the lowest risk. So, for example, we identify whether you have historically had a CCJ or been bankrupt - which would lower your score; however these may be partially offset by, for example, if your identity can recently be verified at your address and general indicators about the area in which you live such as average household income and average house prices. The overall score is created by adding each of the factors together. The data included in these scores will differ by insurance provider but may include information from credit reference agencies and/or other commercially available indicators, such as the known demographics in the neighbourhood where you live, as described further in the "What data is collected and from whom it is obtained" section below. These risk scores may also be used by our Customers in order to provide you with a quote at renewal. Similar to widely-used credit scores which lenders use to help establish your ability to repay credit, these insurance risk scores are used by our Customers to help assess the likelihood that an applicant will make an insurance claim. LexisNexis Quote Intelligence When an applicant applies for insurance via a price comparison website, we obtain information about the applicants requests, which we use to separate normal shopping behaviour from potentially fraudulent behaviour. For example, it is accepted that different levels of voluntary excess payable on a policy may be selected in order to obtain a more favourable premium. However, some behaviour is not normal and could lead to an applicant fraudulently obtaining insurance at an unreasonably low price, such as inputting different dates of birth for the same person on different requests. Quote Intelligence identifies potential manipulation by linking any quotes undertaken by the same individual(s) over the previous 90 days and comparing the information, such as date of birth, address

8 and number of previous claims, to the information supplied in each request. We do not determine whether these differences, or the number of changes, are of importance to an insurance provider or whether it should affect the premium offered. QI simply notifies the insurance provider whether the applicant has entered different details in past applications. Developing our statistical models Protecting our legitimate business interests and legal rights We use personal data for statistical analysis to improve our products and services and to help insurers better predict risk, to validate data you provide and to help to prevent fraud. To do this, we compare policy information against variables, like age, address, income and driving history to help insurers predict risk more accurately. Where we believe it is necessary to protect our legal rights, interests and the interests of others, we use personal data in connection with legal claims, compliance, regulatory, and audit functions, and disclosures in connection with the acquisition, merger or sale of a business. Where required by law In exceptional circumstances, we may be required by law to provide personal data to law enforcement agencies, courts or others in connection with claims and other litigation.

9 What personal data is collected and from whom it is obtained Our services depend on collecting accurate and up to date personal data. We obtain this data from the following sources: Insurance providers, brokers and comparison services When an individual buys or renews an insurance policy, certain insurers and brokers will add personal data and information about the individual's policy to our insurance industry database. This data may include the name of the insurer, the address and other identifying information, details of the request for insurance, the policy start date and details about other registered drivers and other policy and claims information. We continually update the information about policy histories. For example, if an individual makes a claim against a policy held by an insurer that partners with us, that affects their No Claims Discount, we will receive information about that update. This data is used by Customers of our No Claims Discount Module, Policy Insights and Attract products. We also obtain personal data that individuals provide to certain insurers and brokers when they request a quote or apply for insurance. We use this information to provide Customers with our Quote Intelligence product that allows them to help to assess risk and prevent fraudulent applications as described above. We ask our Customers to let individuals who apply for insurance know before they share policy or quote information with us for example, by telling the individual about this in their application form or in the Customer s processing notice. Public and publicly-available records We receive the following personal data from public and publicly-available sources for use in the Products stated (which we may receive directly from the sources or from the LNRS data partners described below): Product Source Categories of personal data we use LexisNexis Risk Insights; LexisNexis Attract (motor); and LexisNexis Indicium Bankruptcy and insolvency databases, such as the Individual Insolvency Register (IIR) and information published by The Stationary Office (TSO) Property related information, such as Her Majesty s Land Registry (HMLR) - Land Registry Information about debt and insolvency, such as type of insolvency, status and dates of judgments; Along with the address and postcode we receive information such as property type, age of property, tenure and sale prices;

10 County and High Court Judgments, such as provided by credit reference agencies and Registry Trust Limited Information on court judgments that have been issued, such as how much money was owed and whether the judgment has been satisfied; Registered commercial entity information, such as Companies House Credit reference agency, such as public credit data Open Electoral Register Data on directorships, such as presence of a director within a postcode area; Identifier information, such as name, address and date of birth; We receive an extract of the Open Electoral Register, including data such as name, current address and any previous addresses. LNRS data partners We receive the following personal data from our data partners: Source Other members of the RELX Group Third-party data partners Categories of personal data we receive LNRS receives data from other RELX Group companies. This includes identification data (such as names and addresses) and fraud prevention indicators (such as information about debt and insolvency). LNRS also receives data from reputable commercial sources. This includes identification data (such as names and addresses), fraud prevention indicators (such as County Court Judgments) and consumer insight data (such as individual, household and postcode level consumer segmentations).

11 How personal data is shared and retained With whom we share personal data and how we safeguard transfers of personal data We share personal data with the categories of third-parties described below. Where personal data is transferred to a country outside the European Economic Area ("EEA"), we safeguard the data as described below. Insurers and brokers We share personal data with insurers, brokers and other insurance intermediaries when an individual requests a quote or makes an application for insurance or where the insurer is initiating a renewal quote. We ask insurers and brokers to explain to individuals that they use our information. We share personal data with service providers who assist us with our products and services. These providers include, customer support, IT service providers, financial services and professional advisors. Service providers Other affiliated companies of LexisNexis Risk Solutions within the RELX Group of companies Where we share personal data with service providers in countries outside of the EEA, we make use of the EU-U.S. Privacy Shield Framework, European Commission-approved standard contractual data protection clauses, binding corporate rules for transfers to data processors (approved under Article 46(2)(b) of the General Data Protection Regulation), and other appropriate legal mechanisms to safeguard the transfer. Some of the service providers we use are other affiliated companies of LNRS within the RELX group of companies. These companies assist us in providing the products and services described in this Notice, such as to provide customer and product support. We have contracts in place with them to ensure they only use the personal data we provide them in accordance with our instructions. These affiliates are located in the United Kingdom, the Republic of Ireland and the U.S. Where we share personal data with LNRS affiliates in countries that do not have equivalent data protection legislation to the EEA, such as our affiliates in the U.S., we rely on the EU-U.S. Privacy Shield Framework (approved under Article 45 of the General Data Protection Regulation) to safeguard the transfer as well as standard contractual data protection clauses,

12 which have been approved by the European Commission under Article 46(2)(c) of the General Data Protection Regulation. If some or all of the LNRS or RELX business is acquired by another company, personal data may be disclosed to the prospective or actual purchasers. We also share personal data in order to: Third parties where required by law (or to protect our rights) comply with the law; investigate and help prevent security threats, fraud or other malicious activity; enforce and protect the rights and property of LNRS or its affiliates; or protect the rights of our Customers, employees and third parties. This may include sharing information for the purposes of crime prevention and fraud protection. How long we retain personal data We retain personal data as follows Policy and Quote history Identification data Court judgments, bankruptcies, administrative orders We retain information concerning previous and existing policies and quotes for the periods specified by the insurer. While these retention periods may differ from one insurer to another, in general we retain policy data for up to 8 years and quote data for up to 7 years. We retain identification data (such as names and addresses including from the Open Electoral Register) whilst there is a continuing need for us to utilise it. We keep this retention under review and we will remove data as and when we no longer require it. We retain information about court judgments or orders for up to 6 years from the date of the judgment or order (or a shorter period if the judgment is set aside or repaid). For bankruptcy, IVAs or other insolvency related events and arrangements, we usually keep such data for up to 6 years (or, if such events are extended, then for that longer period).

13 Other public records Scores, records of searches by insurers and other data we derive We retain other publically sourced information such as information from the Land Registry or from Companies House for up to 7 years. The information we process about you is updated if an insurer provides us with new personal data, or if we collect updated information from public sources. If an insurer runs a search about you, each type of information, or an overall score, if they use Attract or Indicium) are provided based on the information available to us at the time of the search. We retain a record of such searches and any metrics present in the search for up to 7 years from the date of the search.

14 How you can request to access, correct or delete your personal data or ask us not to process your personal data In accordance with the General Data Protection Regulation (the GDPR ), we provide you with the ability to exercise your rights regarding your personal data in the following ways: Find out if we process your personal data, obtain a copy of the data or correct inaccurate data To find out if we process any of your personal data to access a copy of such personal data we may hold about you or correct any personal data that you believe is inaccurate, incomplete or out of date, you may contact us as provided in the How to contact us section below. In order to provide you with an appropriate response we may ask for relevant identification documents to confirm your identity in handling your request and also send you a short form to complete to clarify the request and ensure it is dealt with efficiently and in accordance with the GDPR. How you can object to or request to restrict, delete or transfer your personal data If you object to our processing of any personal data we may hold about you as a controller, or you wish to restrict our use of it or request its deletion, you may contact us as provided in the How to contact us section below. As stated above, we may also ask for relevant identification documents to confirm your identity in handling your request and also send you a short form to complete to clarify the request and ensure it is dealt with efficiently and in accordance with the GDPR. Your rights to object to, or request that we restrict our use of, or delete, your personal data may be limited where we are legally required to process your personal data or have compelling reasons to override your request. The GDPR also gives individuals a right to ask for information which they have given to a company, to be transferred to other companies (for example you can ask for services managed online such as utilities, phone or to be switched between providers). The GDPR describes this as a data portability request. As we don t collect information directly from individuals in this way, this right does not apply to the personal data used in our services. If you have unresolved concerns, you have the right to complain to a data protection authority in the country where you live, where you work or where you feel your rights were infringed.

15 How to contact us If you have any questions or wish to exercise any of the rights described in this Processing Notice, please contact our Data Protection Officer (at the following address) whom we have appointed to respond to enquiries regarding any of the products connected to the data controllers described in this Notice: Data Protection Officer LexisNexis Risk Solutions Global Reach Dunleavy Drive Cardiff CF11 0SN The data controller for each LNRS service is described below: Services LexisNexis Policy Insights Data controller LexisNexis Risk Insights LexisNexis Attract for Motor LexisNexis Risk Solutions UK Limited* No Claims Discount Module for LexisNexis Policy History Motor LexisNexis Indicium Insurance Initiatives Limited* LexisNexis Quote Intelligence *LexisNexis Risk Solutions UK Limited and Insurance Initiatives Limited are part of the LexisNexis Risk Solutions division in the RELX Group of companies